Privacy Policy

Last updated: 4 November 2026

This Privacy Policy explains how Shira (“Shira”, “we”, “us”) collects, uses, shares, and protects personal information across the Shira website (getshira.com), the merchant portal, merchant storefronts, and the Shira merchant mobile app (together, the “Services”). By using the Services you agree to this policy.

Who we are

Shira is an e-commerce platform that lets merchants in the Syrian and Arab market create an online store and receive orders. Depending on how you use the Services, you may be a merchant (store owner or staff) or a customer buying from a merchant’s storefront. For questions about this policy, contact us at support@getshira.com.

Information we collect

We collect the following, depending on how you use the Services:

Account information: your name, email address, and phone number (used to sign in via a one-time code).
Merchant / store information: store name, contact details, business information, and the payment and shipping settings you enter.
Order and customer information: when a customer places an order on a merchant storefront we receive the name, phone number, delivery address, and order contents.
Payment information: processed by our payment providers; we do not store full card numbers. Cash-on-delivery and bank or wallet transfers are recorded only as the chosen method.
Mobile app and device data: device model, operating system, app version, and a push-notification token. Biometric unlock (Face ID / fingerprint) is handled by your device and is never transmitted to us.
Content you provide: product images you upload from your camera or photo library, only when you choose to.
Usage and technical data: IP address, pages viewed, a first-party storefront visitor identifier for basic analytics, cookies needed to sign in, a campaign attribution cookie on our marketing website, advertising cookies set by the Meta pixel and analytics cookies set by Google Analytics on that website and on the sign-up pages of app.getshira.com, and diagnostic and error data.

Required and optional information

To place an order we need your name, phone number, city, area and street, and the building when the store asks for it; without them the store cannot deliver. Floor, apartment, order notes and email are optional unless the store asks for email. In your buyer account, birth date and gender are optional and you can clear them at any time. Merchants must give a name, email and phone to open a store.

How we use your information

Provide and operate the Services: accounts, storefronts, orders, and the mobile app.
Authenticate you with one-time codes, keep accounts secure, and prevent fraud and abuse.
Send the transactional messages you would expect (sign-in codes, order confirmations, and order alerts) by email, push notification, and, where available, SMS.
Process payments and support order fulfilment and delivery.
Maintain, troubleshoot, and improve the Services using diagnostics and aggregate analytics.
Measure and improve our own marketing: understand which campaigns and links bring merchants to Shira, and measure and optimise the advertising we run.
Comply with legal, tax, and accounting obligations.

Legal basis for each use

Running your account, store and orders, delivery and payment: to perform our contract with you (or the merchant’s contract with you as a buyer).
Sign-in codes, security, fraud prevention, security logs: our legitimate interest in keeping the Services safe, and legal obligations.
Marketing messages from Shira or from a store, and advertising cookies where consent is required: your consent or, for messages Shira sends merchants, our legitimate interest; either way you can stop them at any time.
Account notices about your loyalty points (points earned, new tier, points about to expire): part of the service you joined, no separate consent.
Tax, accounting and legal requests: legal obligation.
Optional profile fields (birth date, gender): your consent, by filling them.

How we share information

We do not sell your personal data. We share information only as follows:

Between a merchant and their customer: completing an order shares the customer’s contact and delivery details with that merchant, and the merchant’s contact details with the customer, so the order can be fulfilled.
Service providers acting on our behalf: payment processing (Paymera and the other methods a merchant enables), transactional email (Amazon SES), hosting and network security (Hetzner in Germany, and Cloudflare), error monitoring (Sentry), and push-notification delivery (Expo, Apple APNs, and Google FCM). The app stores (Apple App Store and Google Play) process app downloads and updates. We also use AI assistance (Alibaba Cloud, Singapore: product text and support questions only, with emails and phone numbers removed), sign-in codes by WhatsApp (Meta) and SMS (Syrian mobile operators), and delivery companies (Tarabut, Babel, Masarat, Fatih).
Advertising measurement: on our marketing website getshira.com, the Meta pixel reports to Meta Platforms that a page was viewed, and that a button leading to sign-up or to a plan was pressed, together with which button or plan it was, so that we can measure and optimise our own advertising. When you create a store on app.getshira.com, Meta is also told, once, that an account was created (see below). On the same website, and on the sign-up pages of app.getshira.com, Google Analytics reports to Google which page was viewed, which campaign or advertisement the visit came from, and which sign-up step was completed, so that we can tell which of our advertising sources bring merchants to Shira. See “Cookies and similar technologies” below.
Legal and safety: when required by applicable law, or to protect the rights, property, or safety of Shira, our users, or the public.

Where your data is stored

Our servers are hosted in Germany (European Union), with encrypted backups on Cloudflare’s network. If you access the Services from Syria or another country, your information may be processed and stored outside your country of residence.

Transfers outside the EEA. Three recipients process data outside the European Economic Area: Meta Platforms Ireland, which receives advertising measurement from getshira.com and app.getshira.com and transfers to Meta Platforms, Inc. in the United States under the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses; Google Ireland Limited, which operates Google Analytics on getshira.com and on the sign-up pages of app.getshira.com and transfers to Google LLC in the United States on the same basis; and the app stores and push services (Apple, Google, Expo) that deliver our mobile app and its notifications, on the same clauses. Where you are in the EEA, the United Kingdom, or Switzerland, our legal basis for the advertising pixel, Google Analytics and the campaign attribution cookie is your consent, which you give or refuse in the cookie banner and can withdraw at any time; for everything else it is the performance of our contract with you and our legitimate interest in running and securing the Services.

For people in Saudi Arabia, we transfer data outside the Kingdom only with the safeguards the Saudi Personal Data Protection Law requires.

Data retention

We keep personal data only as long as we need it, then delete or anonymise it, except data of closed stores, which we keep until we set a final deletion period:

Buyer account: until you delete it. Deletion takes effect after 14 days, in case you change your mind.
Orders: kept as the store’s financial record, also after you delete your account, because stores need them for accounting, returns and disputes.
Reviews: kept while the store exists; your name is removed from them when you delete your account.
Unfinished carts: deleted 90 days after the last activity. Carts that reached payment are kept with the order record.
Sign-in code attempts: 30 days.
Store marketing: loyalty reminders 400 days; store pop-up answers 90 days after the store handles them; newsletter sign-ups until you or the store remove them.
Emails Shira sends to store owners: the recipient list is deleted 90 days after the send ends.
Store visit statistics: 180 days.
Waitlist: until you ask us to remove you; the IP address and browser details are removed after 90 days.
Server and security logs: 7 days. Error reports: as set by our error monitoring provider.
Backups: encrypted, kept 90 days. Data deleted from the Services leaves the backups when they expire.
Merchant accounts: when you delete your store, it is closed after 14 days and is no longer available to anyone. Its data stays with us and is not deleted automatically yet; you can ask us to delete it.

Your rights and choices

You have the rights below. We answer every request within 30 days. If we need more time, we tell you why within those 30 days and answer within 30 more. We may ask you to prove it is your account before we act. If you bought from a store, the store decides about its own records; we help it answer you.

Know what data we hold about you, why, and on what basis (this policy).
Access your data and get a copy: from your account, sent to your email (buyers: Profile, “Export my data”, once an email is on your profile; merchants: Settings, Security, “Export all data”), or ask us.
Correct it: edit your profile in the account, or ask us.
Delete it: from your account (buyers: Profile, “Delete account”; merchants: “Delete store” in Settings, General closes the store but does not erase its data, so contact us to request erasure), or ask us. Some records stay, as listed under Data retention.
Withdraw consent at any time, as easily as you gave it: marketing email through the unsubscribe link in every marketing email, cookies through the “Cookies” button at the bottom of getshira.com (shown once you have answered the banner).
Notifications: turn off non-essential push notifications in the app’s notification settings; essential messages such as sign-in codes are required to use the Services.
Complain to the competent data protection authority in your country (in Saudi Arabia: the Saudi Data and AI Authority, SDAIA).

Security

We protect your data with encryption in transit (HTTPS/TLS), strict isolation between merchants, and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to address any issues promptly.

Cookies and similar technologies

Essential. Cookies needed to sign you in and keep your session. These cannot be turned off, and blocking them will stop you signing in.

Partner referral. If you arrive through a link from one of our partners (a link carrying ?ref= and the partner’s code), a cookie named shira_ref keeps that code for 30 days, so that if you then open a store, the partner who referred you is credited. It holds the partner’s code and nothing else, can be read only by our servers, and is never shared with a third party. Only the first partner link is kept. Because it neither tracks you nor measures advertising, it is set without asking, wherever you visit from. You can delete it in your browser settings at any time.

Our own analytics and attribution. A first-party identifier that lets a merchant see basic, aggregate visitor analytics for their storefront. Separately, on our marketing website getshira.com, a cookie named shira_attr records which campaign or link brought you to us, so we can tell which advertising actually works. It lasts 90 days, can be read only by our servers, and contains no name, email address, or phone number.

Website analytics, without cookies. On our marketing website we run Umami, an analytics tool we host ourselves, on our own server, under an analytics subdomain of this site. The data is not shared with an analytics company and it adds no recipient to the transfers described above; like every other page here, the request passes through Cloudflare, which we already name above as our hosting and network-security provider. Umami sets no cookie and stores no identifier on your device. What it records for each visit is the page address, the link that referred you, your screen size, your language, and the country your IP address resolves to. Your IP address itself is not stored: it is combined with your browser type and a secret that changes every month into a one-way fingerprint that groups the pages of a single visit together, and because that secret rotates, visits cannot be followed from one month to the next. Campaign parameters are stripped before the page address is stored, so an advertising click identifier is never kept alongside it. We also record which of a small number of actions were taken on a page, such as opening a question or pressing a pricing button, so we can tell which parts of the site are useful. Because none of this is stored on your device it runs without asking, but it honours the “Do Not Track” setting in your browser: switch that on and nothing about your visit is recorded, and the request for the analytics file itself is excluded from our server logs. One note for completeness: because the analytics subdomain is part of this site, your browser attaches the shira_attr attribution cookie described above to requests for it. Umami never reads it.

Third-party advertising. On our marketing website getshira.com, we run the Meta (Facebook) pixel. It sets its own cookies, including _fbp, and tells Meta that a page was viewed, and that a button leading to sign-up or to a plan was pressed, together with which button or plan it was, so that we can measure our advertising and Meta can optimise how it is delivered. When you create a store on app.getshira.com, we also tell Meta, once, that an account was created: our server sends that event with your IP address, your browser's user agent, your email address and phone number in hashed form (turned on our server into a one-way code before they are sent) so that Meta can match them with the details of its own users and count the sign-up for the right advertisement, the _fbp identifier if the pixel set one, and, if you arrived from a Meta ad, that ad's click identifier; your browser sends the same event to Meta directly so that it is counted once. We do this only when we can tell that you are not in the European Economic Area, the United Kingdom, or Switzerland, and app.getshira.com does not load the pixel's script or set its cookies. We do not send Meta your name or your store's details, and we never send your email address or phone number in readable form. The pixel does not run on merchant storefronts or in our mobile apps.

Third-party analytics. On our marketing website getshira.com, and on the sign-up pages of app.getshira.com, we also run Google Analytics. It sets its own cookies, including _ga, and tells Google which pages were viewed, which campaign, advertisement or link the visit came from, and which sign-up step was completed, so that we can tell which of our advertising sources bring merchants to Shira. We do not send Google your name, email address, or phone number, we do not link it to an account, and we have switched off Google signals and advertising personalisation, so it is not used to build an advertising profile of you or to follow you across devices. It does not run on merchant storefronts, in the merchant dashboard, or in our mobile apps.

Asking first, and where. If you are visiting getshira.com from the European Economic Area, the United Kingdom, or Switzerland, we ask before setting the attribution cookie or loading the Meta pixel or Google Analytics: until you accept, none of them happens. Your choice is remembered for a year, declining is a real choice rather than a delay, and you can change it at any time from the cookie control at the bottom of the page. The sign-up pages of app.getshira.com show no banner: if you visit them from those regions, Google Analytics is not loaded there at all and Meta is not told that an account was created. To be exact about the limit of that promise: it covers this marketing website and those sign-up pages. Merchant storefronts serve customers in Syria, which has no cookie-consent regime, and they set the first-party visitor identifier described above without a banner. A merchant who switches on their own advertising or analytics tag on their storefront chooses that themselves and is responsible for consent in the markets they sell to.

You can clear or block cookies in your browser settings, you can control how Meta uses your activity in your Meta account settings or through the advertising controls in your browser or device, and you can stop Google Analytics in every website with Google’s browser opt-out add-on.

Children

The Services are for adults. To buy or open a store you must be 18 or older, or have a parent or guardian act for you. We do not knowingly collect data from children; if you believe a child gave us data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date above; we may also communicate significant changes in the app or by email.

Contact us

For any question or request about your personal data, write to support@getshira.com. We reply within 30 days. Shira is the controller of platform accounts and of getshira.com; for a store’s customer data, the store is the controller and Shira processes it for the store.